Our site uses cookies to provide you with the best possible user experience, if you choose to continue then we will assume that you are happy for your web browser to receive all cookies from our website. If you would like more information, please visit our cookie policy page.

Adding information that examines how the controls may be degraded is an area where the bowtie
excels. It allows for the inclusion of a level of detail entirely appropriate to the management of
controls. In bowtie these are known as escalation factors.

In our driving a car on a busy motorway example, an escalation factor would be the driver
lacking the knowledge of how to counteract the tyre blow out, therefore the driver not appreciating
the need to steer into the skid to keep control.

Definitions

A condition that leads to increased risk by defeating or reducing the effectiveness of controls
(a control decay mechanism).

Controls are seldom 100% effective and history teaches us that they do fail. We need to
understand the factors that cause this to happen.

An escalation factor is a condition that leads to increased risk by reducing the effectiveness
of controls. An escalation factor cannot directly cause the top event or consequence rather it
increases the likelihood that the scenario will progress because the associated control will be
degraded or fail.

Guiding principles

Escalation factors should not cause the top event (in this case they would be threats).

Traps and tips

Trap: Escalation factor descriptions that are too generic e.g. ‘radio does not work’.

Tip: Escalation factors should define how or why the control is degraded. They should
identify the real cause of the failure.

Trap: Extensive use of escalation factors can make the size of the diagram explode, and
this impacts readability quite significantly. Adding escalation factors that are theoretically
possible but in reality are not a problem adds un-necessary complexity.

Tip: Ask: Is it really a problem? If yes, include it as an escalation factor.

Trap: Escalation factors that only state the negative of the control. The mere negative of
a control as an escalation factor should be avoided - it adds no useful information e.g. control:
‘conflict visually detected by driver’; escalation factor: ‘conflict not visually detected by
driver’.

Tip: Escalation factors should define how or why the control is degraded (e.g. ‘low
visibility conditions prevents visual detection by driver’).

Trap: Generic escalation factors. Avoid generic escalation factors, as the result will
usually be an explosion in the diagram size without adding any useful information.

Tip: For escalation factors which are considered to be a significant risk when
working on a higher-level generic issue, it is advised to bowtie that issue separately (e.g.
hazard: ‘fatigue’; top event: ‘personnel suffering fatigue to the extent that they do not
perform to the expected standard’).